CVE-2024-31835

CVE-2024-31835 flatpress CMS Flatpress v1.3 中存在跨站脚本（XSS）漏洞，远程攻击者可以通过向文件名参数传递特制载荷来执行任意代码。 受影响组件： FlatPress CMS 管理面板文件上传字段 修复版本： Flatpress v1.3 - 将在 FlatPress 1.3 版本中修复。 攻击类型：远程 攻击向量：通过构造图片文件名来利用漏洞 复现步骤： 1. 登录管理员账号并打开以下 URL：http://127.0.0.1/flatpress-1.2.1/admin.php?p=uploader&action=mediamanager 2...

CVE-2024-34471

CVE-2024-34471 描述： 经过身份验证的用户可以利用mliRealtimeEmails.php文件中的路径遍历漏洞（如果具有写入权限，可导致文件删除）。导出HTML功能中的filename参数未正确验证文件位置，允许攻击者读取并删除服务器上的任意文件。当mliRealtimeEmails.php文件本身被读取并随后删除时，观察到该漏洞，导致文件返回404错误并中断邮件信息加载。 版本： 发现于HSC Mailinspector 5.2.17-3，但适用于至5.2.18的所有版本。 概念验证...

CVE-2020-5398

CVE-2020-5398 - Ataque RFD Reflected File Download para Spring MVC No Spring Framework, versões 5.2.x anteriores a 5.2.3, versões 5.1.x anteriores a 5.1.13 e versões 5.0.x anteriores a 5.0.16, um aplicativo está vulnerável a um ataque de download de arquivo refletido RFD quando define um cabeçalh...

rConfig <= 3.9.4 - Authenticated OS Command Injection

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...

Movies <= 0.6 - Cross-Site Scripting

A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4539 info: name: Movies = 0.6 - Cross-Site Scripting author: daffainfo...

CVE-2023-49031

LFI Tikit eMarketing CVE-2023-49031 Обнаружение В ноябре 2023 года в ходе работы с клиентом была выявлена новая уязвимость включения локальных файлов в платформе «eMarketing», разработанной компанией Tikit ныне Advanced. Проблема была устранена совместно с Advanced в феврале 2024 года. Затронутые...

POC_CVE-2024-10829

POCCVE-2024-36420 Lokales Reproduktionslabor und Nuclei-Template-Entwurf für CVE-2024-36420, das Flowise betrifft. Zusammenfassung CVE-2024-36420 ist ein beliebiges Dateilesen in Flowise, verursacht durch unsaubere Verwendung des fileName-Body-Parameters in: POST /api/v1/openai-assistants-file...

POC_CVE-2024-36420

POCCVE-2024-36420 Laboratorio di riproduzione locale e bozza di template nuclei per CVE-2024-36420 che colpisce Flowise. Sommario CVE-2024-36420 è una lettura arbitraria di file in Flowise causata dall'uso non sanificato del parametro body fileName in: POST /api/v1/openai-assistants-file Questo...

CVE-2024-53677

Origine del POC https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/ Condizioni per la RCE 1. Nessuna restrizione sulle estensioni di file pericolosi 2. Al momento del caricamento, il nome...

gin-vulnerable

gin-vulnerable Consumer demo vincolato a github.com/gin-gonic/gin v1.7.0 vulnerabile a CVE-2023-29401. L'handler /download/:filename passa l'input dell'utente direttamente a Context.FileAttachment — il pattern di condizione di exploit che Endor segnala come sfruttabile...

CVE-2025-5880

Whistle 2.9.98 contiene una vulnerabilità di path traversal non corretta perché l'endpoint /cgi-bin/sessions/get-temp-file non riesce a sanificare adeguatamente l'input utente nel parametro filename. Fornendo percorsi assoluti o sequenze di traversal come /etc/passwd, un attaccante può bypassare ...

CVE-2022-29598

CVE-2022-29598 : Reflektiertes Cross-Site-Scripting XSS in RSS v500 Mitre-URL: https://vulners.com/cve/CVE-2022-29598 NIST-URL: https://nvd.nist.gov/vuln/detail/CVE-2022-29598 Die RRS v500-Anwendung von Solutions Atlantic ist anfällig für eine reflektierte Cross-Site-Scripting XSS-Schwachstelle...

CVE-2022-29597

CVE-2022-29597: Inclusione di File Locali in RSS v500 L'applicazione RRS v500 di Solutions Atlantic è vulnerabile a una vulnerabilità di Inclusione di File Locali LFI. Qualsiasi utente autenticato ha la possibilità di fare riferimento a file di sistema interni nelle richieste effettuate alla pagi...

CVE-2024-12209

CVE-2024-12209 WP Umbrella: Update Backup Restore & Monitoring = 2.17.0 - Inclusione di File Locale Non Autenticata Descrizione Il plugin WP Umbrella: Update Backup Restore & Monitoring per WordPress è vulnerabile all'Inclusione di File Locale in tutte le versioni fino alla 2.17.0 inclusa, tramit...

CVE-2023-26255-6

Script POC per la vulnerabilità di lettura arbitraria di file nel parametro FileName di STAGIL Navigation per Jira Istruzioni per l'uso: Rilevamento su URL singolo 1. Usare l'interfaccia a riga di comando per testare un singolo URL, passando il parametro -U con l'URL. 2. Osservare il risultato...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

CVE-2026-75111

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...

EUVD-2026-52506

A stack-based buffer overflow vulnerability exists in the cmdedl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fwflash command, where the argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical...

CVE-2026-18601

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.checkconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack ...

CVE-2026-67673

A stack-based buffer overflow vulnerability exists in the cmdedl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fwflash command, where the argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical...